Open to opportunities

Harilal User

@harilaluser

Message

I build SOC detections and investigate malware traffic, logs, and security incidents.

India

Message

What I'm looking for

I'm seeking a cybersecurity internship where I can contribute to SOC operations, DFIR, or detection engineering through malware traffic analysis, SIEM investigations, incident response, and detection development.

I've investigated live Bandook RAT and TA551/TrickBot traffic during a remote SOC internship at Gardiyan System Security Technologies, using Splunk and Wazuh to identify dual C2 infrastructure and extract actionable IOCs.

I build practical detection engineering tools and labs, including TRACEX, a standalone Python Windows Event Log analyzer with correlated rules, MITRE ATT&CK mapping, SQLite persistence, confidence scoring, and an interactive HTML dashboard. I tested it against 28,000+ real events and fixed a real service-account false positive.

My home SOC lab combines Splunk, Wazuh, Kali Linux, VMware Workstation, and an OpenCanary honeypot in a segmented DMZ. I use it for log analysis, malware traffic investigation, alert tuning, and validating detections against real Windows telemetry.

I'm pursuing a B.Tech in Computer Science Engineering and seeking an internship in SOC operations, DFIR, or detection engineering.

Experience

Work history, roles, and key accomplishments

SOC Analyst Intern

Gardiyan System Security Technologies

Sep 2025 - Jan 2026 (4 months)

Analyzed live Bandook RAT and TA551/TrickBot PCAP traffic in Splunk and Wazuh, identifying dual C2 infrastructure and extracting IOCs. Mapped WannaCry ransomware lifecycle to MITRE ATT&CK and Cyber Kill Chain, built 5 Splunk correlation rules, and designed SOAR playbook architecture on Shuffle.